None of the post and get data going into the scripts is being escaped.
Everything should be escaped before hitting the database.
Log in to post a comment.